Set Up LDAP Authentication
LDAP is often used by organizations as an authentication service and a central repository for user information. It can also be used to store the role information for application users.
- Create a server
profile.The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.When you use LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
- Select DeviceServer ProfilesLDAP, and then Add an LDAP server profile.
- Enter a Profile Name, such as GP-User-Auth.
- If this profile is for a firewall with multiple virtual systems capability, select a virtual system or Shared as the Location where the profile is available.
- Click Add in the Server List area, and then enter the necessary information for connecting to the authentication server, including the server Name, IP address or FQDN of the LDAP Server, and Port.
- Select the LDAP server Type.
- Enter the Bind DN and Password to enable the authentication service to authenticate the firewall.
- (Optional) If you want the endpoint to use
SSL or TLS for a more secure connection with the directory server,
enable the option to Require SSL/TLS secured connection (enabled
by default). The protocol that the endpoint uses depends on the
- 389 (default)—TLS (Specifically, the device uses the StartTLS operation, which upgrades the initial plaintext connection to TLS.)
- Any other port—The device first attempts to use TLS. If the directory server doesn’t support TLS, the device falls back to SSL.
- (Optional) For additional security, enable
to the option to Verify Server Certificate for SSL sessions so
that the endpoint verifies the certificate that the directory server
presents for SSL/TLS connections. To enable verification, you must
also enable the option to Require SSL/TLS secured connection.
For verification to succeed, the certificate must meet one of the
- It is in the list of device certificates: DeviceCertificate ManagementCertificatesDevice Certificates. If necessary, import the certificate into the device.
- The certificate signer is in the list of trusted certificate authorities: DeviceCertificate ManagementCertificatesDefault Trusted Certificate Authorities.
- Click OK to save the server profile.
Create an authentication profile.The authentication profile specifies the server profile that the portal or gateways use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles to one or more client authentication profiles. For descriptions of how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.To enable users to connect and change their expired passwords without administrative intervention, consider using Remote Access VPN with Pre-Logon.If a user’s password expires, you can assign a temporary LDAP password to enable them to log in to GlobalProtect. In this case, the temporary password may be used to authenticate to the portal, but the gateway login may fail because the same temporary password cannot be re-used. To prevent this issue, configure an authentication override in the portal configuration (NetworkGlobalProtectPortal) to enable the GlobalProtect app to use a cookie to authenticate to the portal and the temporary password to authenticate to the gateway.
- Select DeviceAuthentication Profile, and then Add a new profile.
- Enter a Name for the profile.
- Set the AuthenticationType to LDAP.
- Select the LDAP authentication Server Profile that you created in step 1.
- Enter sAMAccountName as the Login Attribute.
- Set the Password Expiry Warning to
specify the number of days before password expiration that users
are notified. By default, users are notified seven days prior to
password expiration (range is 1-255). Because users must change
their passwords before the end of the expiration period, you must
provide a notification period that is adequate for your users in
order to ensure continued access to GlobalProtect. To use this feature,
you must specify one of the following LDAP server types in your
LDAP server profile: active-directory, e-directory,
or sun.Unless you enable pre-logon, users cannot access GlobalProtect when their passwords expire.
- Specify the User Domain and Username
Modifier. The endpoint combines the User Domain and Username
Modifier values to modify the domain/username string
that a user enters during login. The endpoint uses the modified
string for authentication and the User Domain value
for User-ID group mapping. Modifying user input is useful when the
authentication service requires domain/username strings in a particular
format but you do not want to rely on users to enter the domain
correctly. You can select from the following options:
If the Username Modifier includes the %USERDOMAIN% variable, the User Domain value replaces any domain string that the user enters. If the User Domain is blank, tthe device removes any user-entered domain string.
- To send only the unmodified user input, leave the User Domain blank (the default) and set the Username Modifier to the variable %USERINPUT% (the default).
- To prepend a domain to the user input, enter a User Domain and set the Username Modifier to %USERDOMAIN%\%USERINPUT%.
- To append a domain to the user input, enter a User Domain and set the Username Modifier to %USERINPUT%@%USERDOMAIN%.
- On the Advanced tab, Add an Allow List to select the users and user groups that are allowed to authenticate with this profile. The all option allows every user to authenticate with this profile. By default, the list has no entries, which means no users can authenticate.
- Click OK.
- Commit the configuration.Click Commit.
Configure an Authentication Profile
Authentication Profile Device > Authentication Profile Select Device Authentication Profile or Panorama Authentication Profile to manage authentication profiles. To create a new profile, Add one ...
Set Up Kerberos Authentication
Set Up Kerberos Authentication Kerberos is a computer network authentication protocol that uses tickets to allow nodes that communicate over a non-secure network to prove ...
Set Up RADIUS or TACACS+ Authentication
Set Up RADIUS or TACACS+ Authentication RADIUS is a client/server protocol and software that enables remote access servers to communicate with a central server to ...
Configure an Authentication Profile and Sequence
Configure an Authentication Profile and Sequence An authentication profile defines the authentication service that validates the login credentials of administrators who access the firewall web ...
Enable Two-Factor Authentication Using Certificate and Auth...
Enable Two-Factor Authentication Using Certificate and Authentication Profiles The following workflow describes how to configure GlobalProtect to require users to authenticate to both a certificate ...
Test the Authentication Configuration
Test the Authentication Configuration Use the test authentication command to determine if your firewall or Panorama management server can communicate with a back-end authentication server ...
Configure the Portal to Authenticate Satellites
Configure the Portal to Authenticate Satellites In order to register with the LSVPN, each satellite must establish an SSL/TLS connection with the portal. After establishing ...
Test Authentication Server Connectivity
Test Authentication Server Connectivity The test authentication feature enables you to verify whether the firewall or Panorama can communicate with the authentication server specified in ...
Remote Access VPN with Two-Factor Authentication
Remote Access VPN with Two-Factor Authentication If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can ...